syzbot

 sign-in | mailing list | source | docs
🐞 Open [706]
🐞 Fixed [89]
🐞 Invalid [349]
⬇ Missing Backports [43]
Kernel Health Bugs/Month Bug Lifetimes Fuzzing Crashes
💬 Send us feedback

INFO: rcu detected stall in tcp_write_timer

Status: upstream: reported on 2024/06/21 02:50
Reported-by: syzbot+22fe46255c9b9bcfe460@syzkaller.appspotmail.com
First crash: 78d, last: 10d
▶ ▼ Similar bugs (13)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in tcp_write_timer (2) bpf 2 1313d 1368d 0/27 auto-closed as invalid on 2021/05/03 11:59
linux-5.15 INFO: rcu detected stall in tcp_write_timer 1 16d 16d 0/3 upstream: reported on 2024/08/22 21:30
upstream INFO: rcu detected stall in tcp_write_timer net 3 1862d 1857d 0/27 auto-closed as invalid on 2019/10/25 14:11
upstream INFO: rcu detected stall in tcp_write_timer (3) net 1 1180d 1180d 0/27 auto-closed as invalid on 2021/09/13 13:17
upstream BUG: soft lockup in tcp_write_timer (4) kasan mm 4 63d 88d 26/27 fixed on 2024/07/09 19:14
linux-4.14 INFO: rcu detected stall in tcp_write_timer 4 1464d 1707d 0/1 auto-closed as invalid on 2021/01/02 05:45
linux-4.19 INFO: rcu detected stall in tcp_write_timer 2 1593d 1647d 0/1 auto-closed as invalid on 2020/08/26 06:46
linux-4.19 BUG: soft lockup in tcp_write_timer (3) 2 616d 630d 0/1 upstream: reported on 2022/12/17 21:41
linux-4.19 BUG: soft lockup in tcp_write_timer (2) 2 1026d 1090d 0/1 auto-closed as invalid on 2022/03/16 10:56
linux-4.19 BUG: soft lockup in tcp_write_timer 1 1255d 1255d 0/1 auto-closed as invalid on 2021/07/30 14:52
upstream BUG: soft lockup in tcp_write_timer (2) kvm 1 866d 866d 0/27 auto-closed as invalid on 2022/06/24 22:31
upstream BUG: soft lockup in tcp_write_timer (3) net 6 243d 350d 0/27 closed as invalid on 2024/03/18 17:07
android-5-15 BUG: soft lockup in tcp_write_timer 11 26d 139d 0/2 premoderation: reported on 2024/04/21 15:01

Sample crash report:
rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2727 jiffies s: 13001 root: 0x1/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6185 Comm: syz.2.675 Not tainted 6.1.106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:strlen+0x2d/0x60 lib/string.c:495
Code: 56 41 54 53 49 89 fe 48 c7 c0 ff ff ff ff 49 bf 00 00 00 00 00 fc ff df 48 89 fb 49 89 c4 48 89 d8 48 c1 e8 03 42 0f b6 04 38 <84> c0 75 12 48 ff c3 49 8d 44 24 01 43 80 7c 26 01 00 75 dd eb 13
RSP: 0018:ffffc90000006b78 EFLAGS: 00000802
RAX: 0000000000000006 RBX: ffffffff8b0d15a9 RCX: 000000008b0d1500
RDX: ffffffff81b03f44 RSI: ffffffff8d32afc0 RDI: ffffffff8b0d15a0
RBP: ffffc90000006cb0 R08: dffffc0000000000 R09: fffffbfff1d33a7e
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000008
R13: ffffffff81b03f44 R14: ffffffff8b0d15a0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020100000 CR3: 000000004ca74000 CR4: 00000000003506f0
DR0: 0000000020000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 trace_event_get_offsets_lock include/trace/events/lock.h:50 [inline]
 perf_trace_lock+0x10c/0x440 include/trace/events/lock.h:50
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x995/0xa20 kernel/locking/lockdep.c:5673
 rcu_lock_release include/linux/rcupdate.h:355 [inline]
 rcu_read_unlock include/linux/rcupdate.h:824 [inline]
 __perf_event_output kernel/events/core.c:7707 [inline]
 perf_event_output_forward+0x2c0/0x330 kernel/events/core.c:7716
 __perf_event_overflow+0x45e/0x640 kernel/events/core.c:9462
 perf_swevent_hrtimer+0x38e/0x4f0 kernel/events/core.c:10870
 __run_hrtimer kernel/time/hrtimer.c:1686 [inline]
 __hrtimer_run_queues+0x5a7/0xe50 kernel/time/hrtimer.c:1750
 hrtimer_interrupt+0x392/0x980 kernel/time/hrtimer.c:1812
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0x156/0x580 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x3e/0xb0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:__kernel_text_address+0x1b/0x40 kernel/extable.c:79
Code: b9 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 53 48 89 fb e8 37 00 00 00 85 c0 0f 95 c0 48 c7 c1 00 f0 da 8f 48 39 cb 0f 93 c1 <48> c7 c2 48 8c f0 8f 48 39 d3 0f 92 c2 20 ca 08 c2 0f b6 c2 5b c3
RSP: 0018:ffffc90000007530 EFLAGS: 00000287
RAX: 0000000000000001 RBX: ffffffff81785aa3 RCX: ffffffff8fdaf000
RDX: dffffc0000000000 RSI: ffffc90000000000 RDI: ffffffff81785aa3
RBP: ffffc900000075f0 R08: ffffc900000075f0 R09: ffffc900000075b0
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888058c08000
R13: ffffffff81785b50 R14: dffffc0000000000 R15: 1ffff92000000eb5
 unwind_get_return_address+0x49/0x80 arch/x86/kernel/unwind_orc.c:323
 arch_stack_walk+0xf3/0x140 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 kmem_cache_free+0x292/0x510 mm/slub.c:3683
 tcp_write_queue_purge+0x132/0x2f0 net/ipv4/tcp.c:3099
 tcp_done_with_error+0x3d/0xc0 net/ipv4/tcp_input.c:4366
 tcp_write_err net/ipv4/tcp_timer.c:70 [inline]
 tcp_write_timeout net/ipv4/tcp_timer.c:273 [inline]
 tcp_retransmit_timer+0x12ca/0x2800 net/ipv4/tcp_timer.c:547
 tcp_write_timer+0x12e/0x280 net/ipv4/tcp_timer.c:676
 call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1504
 expire_timers kernel/time/timer.c:1549 [inline]
 __run_timers+0x67c/0x890 kernel/time/timer.c:1820
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571
 __do_softirq kernel/softirq.c:605 [inline]
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:666
 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:__folio_memcg+0xa2/0x160 include/linux/memcontrol.h:388
Code: ff 49 f7 07 00 02 00 00 0f 85 9c 00 00 00 41 f6 c6 01 0f 85 a3 00 00 00 41 f6 c6 02 0f 85 aa 00 00 00 49 83 e6 fc 4c 89 f0 5b <41> 5c 41 5e 41 5f c3 4c 89 f8 48 c1 e0 34 75 a4 4c 89 ff be 08 00
RSP: 0018:ffffc90004927280 EFLAGS: 00000286
RAX: ffff888140058000 RBX: ffffea0001c8b9c8 RCX: ffffffff81e916f3
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea0001c8b9c0
RBP: ffffea0001c8b901 R08: dffffc0000000000 R09: fffff94000391739
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff888140058000 R15: ffffea0001c8b9c0
 folio_memcg_unlock mm/memcontrol.c:2161 [inline]
 unlock_page_memcg+0x3d/0xb0 mm/memcontrol.c:2166
 page_remove_rmap+0x819/0xed0 mm/rmap.c:1462
 zap_pte_range mm/memory.c:1453 [inline]
 zap_pmd_range mm/memory.c:1574 [inline]
 zap_pud_range mm/memory.c:1603 [inline]
 zap_p4d_range mm/memory.c:1624 [inline]
 unmap_page_range+0x1217/0x2740 mm/memory.c:1645
 unmap_vmas+0x48b/0x640 mm/memory.c:1730
 exit_mmap+0x252/0x9f0 mm/mmap.c:3227
 __mmput+0x115/0x3c0 kernel/fork.c:1199
 exit_mm+0x226/0x300 kernel/exit.c:565
 do_exit+0x9f6/0x26a0 kernel/exit.c:858
 do_group_exit+0x202/0x2b0 kernel/exit.c:1021
 get_signal+0x16f7/0x17d0 kernel/signal.c:2870
 arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303
 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7ba1979ef9
Code: Unable to access opcode bytes at 0x7f7ba1979ecf.
RSP: 002b:00007f7ba27d7038 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: 0000000000000004 RBX: 00007f7ba1b15f80 RCX: 00007f7ba1979ef9
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000100
RBP: 00007f7ba19e793e R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f7ba1b15f80 R15: 00007ffc560e7738
 </TASK>

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/28 18:29 linux-6.1.y ee5e09825b81 ef3de9e8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: rcu detected stall in tcp_write_timer
2024/08/03 17:11 linux-6.1.y 48d525b0e463 1786a2a8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: rcu detected stall in tcp_write_timer
2024/08/03 14:21 linux-6.1.y 48d525b0e463 1786a2a8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: rcu detected stall in tcp_write_timer
2024/07/26 10:37 linux-6.1.y c18e82d3ee44 3f86dfed .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: rcu detected stall in tcp_write_timer
2024/07/21 13:41 linux-6.1.y 9b3f9a5b12dc b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: rcu detected stall in tcp_write_timer
2024/06/21 02:49 linux-6.1.y eb44d83053d6 dac2aa43 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: rcu detected stall in tcp_write_timer
* Struck through repros no longer work on HEAD.